<!DOCTYPE html>
<!--
/**
 * @package documentation
 * @copyright Copyright 2003-2013 Zen Cart Development Team
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version GIT: $Id: Author: DrByte  Mon Sep 24 14:38:59 2012 -0400 Modified in v1.5.2 $
 */
//-->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">
<!--
body, table{ font-family:Verdana, Arial, Helvetica, sans-serif; font-size:14px; }
fieldset.intro {border-color:#C96E29; }
.intro{background-color:#EEEEEE ; border-color:5778ce; font-size:11px; }
.plainbox, div.callout {border: 1px dashed; border-color:#C96E29; margin:5 40 5 40; background-color: #d7e0f2; }
.heading {background-color:#5778CE; font-weight:bold; font-size:14px;	width: 100%; }
.title1 {color:#C96E29; font-weight:bold; font-size:22px; }
.title2 {color:#C96E29; font-weight:bold; font-size:13px; }
.small {font-size:10px ;}
.error {color:#FF0000; }
.filename {font-family: mono, "Courier New", Courier ; font-size:14px; color: #c96e29;}
.pseudolink {text-decoration:underline; color:#5778CE;}
h1.intro { color: #ffffff; border:1px solid #aca893; background-color: #c96e29;  font-size: 22px;   padding: 4px;}
h1 { color: #ffffff;    border:1px solid #aca893;   background-color: #5778ce;   font-size: 20px;   padding: 4px;}
h2 { color: #c96e29; 	font-size: 18px;}
h3 { color: #5778ce;	font-size: 16px; margin-bottom:0px;}
h4 { color: #c96e29;	font-size: 14px;}
.center {text-align: center}
.style1 {font-size: 10}

-->
</style>
<title>Site Security Recommendations for Zen Cart(R)</title>
<meta http-equiv="imagetoolbar" content="no">
<meta name="author" content="The Zen Cart&reg; Team">
<meta name="robots" content="noindex, nofollow">
</head>
<body>

<fieldset class="intro">
<h1 class="intro center">Zen Cart&reg; Site Security </h1>
<p class="style1">The Zen Cart&reg; software is made available to you for use, additions, changes, modifications, etc. without charge, under the GNU General Public License. <br>
<br>
While we do not charge for this software, donations are greatly appreciated each time you download a new version, to help cover the expenses of maintenance, upgrades, updates, the free support forum and the continued development of this software for your online e-commerce store.
<br>
<br>
Donations can be made at:
<a href="http://www.zen-cart.com/donate" target="_blank">The Zen Cart&reg; Team Page</a>
<br>
<br>
We appreciate your support.<br>
<em>The Zen Cart&reg; Team</em>
</p><br>
<br>

<p class="small center">
Zen Cart&reg; is derived from: Copyright  2003 osCommerce<br>
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;<br>
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE<br>
and is redistributable under the GNU General Public License<br><br>
</p>
</fieldset>
<br>
<fieldset>
<p class="center"><img src="osi-certified-120x100.png" alt="O S I Certified"><br>
This software is OSI Certified Open Source Software.<br>
OSI Certified is a certification mark of the Open Source Initiative.
</p>
</fieldset>
<br>

<fieldset>
<h1 class="center">STEPS IN SECURING YOUR ZEN Cart&reg; STORE </h1>
<h2>SSL Security Protection Tips</h2>
<p>Without applying extra efforts to your connection on the internet you are wandering around an unsecured environment. Before you make administrative modifications to secure Zen Cart® and its database, you need to equip yourself with secure ways to make these modifications. Otherwise if someone is watching/listing to the information you transmit, it might not be long before your private business information becomes public. The bare minimum you should have is access to shared SSL services from your hosting company.</p>
<p>The preferred would be to have a dedicated SSL certificate for your store, as it is more professional in appearance than the use of a shared certificate. There will be an expense incurred to obtain a dedicated SSL certificate and dedicated IP address in your hosting account.</p>
<h2>Accessing Your Site Files Securely</h2>
<p>Instead of using regular FTP to access your server's files, it would be wise (if your hosting company offers FTPS support) to use a program that offers FTP over SSL/TLS. This method will encrypt the information you transmit and receive. This is important especially when you are downloading database backups or configuration files which contain usernames and passwords, etc.</p>
<p>If your hosting company does not offer SFTP or FTPS, then they are most likely not PCI Compliant either, and you should be choosing a different hosting company who takes security seriously. </p>
<h4>The following is a list of several steps you can take to secure your Zen Cart&reg; site:  </h4>
<h1>1. Remove extra folders from your server after install </h1>
<p>It's important that after you've installed your site and are satisfied that it's working properly, including actually doing live transactions to test ALL the payment and shipping modules you're using on your site, be sure to do some cleanup:</p>
<p>REMOVE THE FOLLOWING FOLDERS (and all the files inside them), TO MINIMIZE SECURITY RISKS:<ul><li>/docs</li><li>/extras</li><li>/zc_install</li>
<li>/install.txt (this file can be removed, too)</li></ul>
It is safe to keep these files on *your* own computer (not the server), since they can be used as references/documentation, or used to aid in troubleshooting as diagnostic tools, or for upgrading/installing again in the future. But those folders/files should *not* be on a live webserver.</p>
<p>Optional: Additionally, *IF* you have no intentions of supporting downloadable products or music-media products, you can *also* remove these folders:<ul><li>/download</li><li>/media</li><li>/pub</li></ul>(And you'll need to go to your Admin->Configuration->Attribute Settings->Enable Downloads, and set it to False to turn off the warning message about the missing download folder) In the future, if you choose to add downloadable products to your site or music-products, you will want to re-upload these appropriate folders (and their contents) to your server again, and assign appropriate permissions. </p>

<h1>2. Rename your &quot;/admin&quot; folder </h1>
<p>Renaming the &quot;admin&quot; folder makes it much harder for would-be hackers to get into your admin area. </p>
<p><em>(Before making the following changes, make sure to have a current backup of your files and your database.)</em></p>
<p>A- Find your Zen Cart<span class="filename"> /admin/</span> directory, using your FTP software or your webhost File Manager.<br>
Rename the directory.</p>
<p>B - To login to your admin system you will now have to visit a new URL that matches the new name used in step A above. For example, instead of visiting <em>http://www.example.com/admin/</em> visit <em>http://www.example.com/NeW_NamE4u/</em>. </p>

<h1>3. Use SMTPAUTH or SMTP as your Email Transport method, instead of the generic "PHP" setting.</h1>
<p>Go to Admin->Configuration->Email Options, and change your Email Transport Protocol to SMTPAUTH, and then fill in all the SMTP credentials in the other settings lower on that same screen.</p>
<p>This will not only help prevent outgoing emails from ending up in spam folders, but will also prevent the disclosure of your admin foldername when sending emails from your admin screens.</p>

<h1>4. Set configure.php files read-only</h1>
<p>It's important that you set permissions on the two configure.php files as read-only.<br>
Typically this means setting them to &quot;644&quot;, or in some cases &quot;444&quot;.</p>
<p> The configure.php files are located in:<br>
/&lt;YourStoreFolder&gt;/includes/configure.php<br>
/&lt;YourStoreFolder&gt;/renamed_admin/includes/configure.php </p>
<p>Quite often setting permissions on a file to read only via FTP will not work. Even if the permission looks like it was set to read only, it really may not have been. You must verify the correct setting by entering the store and seeing if there is a warning message on the top of the screen. "Warning: I am able to write to the configuration file:..." In this case you will need to use the "File Manager" supplied with your webhosting account.</p>
<p>If you're using a Windows server, simply set the file as <em>Read-Only</em> for <em>Everyone</em> and especially the <strong>IUSR_xxxxx (Internet Guest Account)</strong> user if running IIS, or the <em>System</em> account or <em>apache user</em> if running Apache. </p>

<h1>5. Delete any unused Admin accounts </h1>
<p><span class="filename">Admin-&gt;Admin Access-&gt;Admin Users</span><br>
In your admin area, open the <strong>Admin Access</strong>menu, and choose <strong>Admin Users</strong><br>
- Check for any unused admin accounts, and delete them. Especially the &quot;Demo&quot; account, if it exists.</p>

<h1>6. Admin Password Security </h1>
<p><strong>It is wise to use complicated passwords so that a would-be hacker cannot easily guess them.</strong><br>
<br>
<span class="error">You can change your admin password</span> in Admin-&gt;Admin Access-&gt;Admin Users, and click on the &quot;<strong>Reset Password</strong>&quot; button. </p>
<p>We recommend that you use passwords that are at least 8 characters long.<br>
Making them alpha-numeric (including letters, numbers, upper-and-lower-case, etc) helps too.<br>
If you are going to use normal words it is a good idea to join together two normal words that don't normally go together.</p>

<h1>7. Admin Access Protection</h1>
<p>It is wise to observe caution while working in your admin area:</p>
<ul>
<li> use only one browser tab to access your admin area</li>
<li> do NOT visit other sites when your browser has an active admin login session enabled even in another tab</li>
<li> always log out of your admin when not using it</li>
</ul>

<h1>8. Protect your &quot;define pages&quot; content in &quot;html_includes&quot; </h1>
<p>After you have finished editing your <strong>define pages</strong> (Admin-&gt;Tools-&gt;Define Pages Editor), you should protect them:</p>
<p> A. Download a copy of them to your PC using your FTP software.  They are located in the <span class="filename">/includes/languages/english/html_includes/</span> folder and subfolders.</p>
<p>B. Make them CHMOD 644 or 444 (ie: &ldquo;read-only&rdquo;). See notes above on CHMOD. <br>
<span class="filename">/includes/languages/english/html_includes</span> &ndash; and all files/folders underneath<br>
<em>(note: on &quot;some&quot; hosts, you must use at least 645 or 555 in order for the contents to still display)</em> </p>
<p>If you make them read-only, then a would-be hacker cannot edit them if they gain access to your system, unless they can get permissions to change the read-only status, which is more complicated.<br>
<br>
<span class="error">NOTE: Of course, once you set them read-only, then you'll need to go and set them back to read-write before making additional changes using the define-pages editor, or uploading replacements via FTP, and then read-only again when done. </span></p>

<h1>9. Use .htaccess files to protect against unwanted snooping </h1>
<p>In several folders, there are<span class="filename"> .htaccess </span>files to prevent users from being able to browse through the files on your site unless they know exact filenames. Some also prevent access to &quot;any&quot; .PHP scripts, since it's expected that all PHP files in those folders will be accessed by other PHP files, and not by a browser directly. This is good for security.<br>
If you delete these files, you run the risk of leaving yourself open to people snooping around.</p>
<p>There are also some semi-&quot;blank&quot; <span class="filename">index.html</span> files in several folders. These files are there to protect you in case your FTP software won't upload .htaccess files, or your server won't accept them. These only prevent directory browsing, and do not stop execution of .PHP files. It's a good &quot;alternative&quot;, although using <span class="filename">.htaccess</span> files in ALL of these folders is  the better choice, for servers that accept them.</p>

<p>In order for the .htaccess settings supplied with Zen Cart&reg; to work, your host must include either 'All' or all of these: 'Limit Options Indexes' parameters to the AllowOverride configuration in the server's apache/conf/httpd.conf file.<br>Some hosts don't like to let you use the OPTIONS directive, so you'll need to leave that line out or put a # in front of it.</p>
<p>If your webhost configuration doesn't allow you to create/use your own <span class="filename">.htaccess</span> files, sometimes they provide an interface in your hosting admin control panel where you can set the desired <span class="filename">.htaccess</span> settings. </p>
<p>It is recommended that you work with your host to configure these settings if this is the method they require. <span class="error">You need to choose -- and use -- the appropriate method for your server.</span> As mentioned above, it's best to work with your web hosting company to select and implement the best method for your specific server. We can't tell you what to use for your specific server, but we offer these guidelines as a starting point.</p>


<h1>10. Protect your &quot;images&quot; and other folders </h1>
During initial installation, you are advised to set your images folder to read/write, so that you can use the Admin interface to upload product/category images without having to use FTP for each one. Similar recommendations are made to other files for various reasons. <br>
<br>
However, leaving the images (or any other) folder in read/write mode means that hackers might be able to put malicious files in this (or other) folder(s) and thus create access points from which to attempt nasty exploits. <br>
<br>
Thus, once your site is built and your images have been created/loaded, you should drop the security down from read/write to read. ie: change from CHMOD 777 down to 644 for files, and to 755 for folders. <br>
<br>
<h4>File/Folder permissions settings</h4>
<p>On Linux/Unix hosts, generally, permission-setting recommendations for basic security are: </p>
<ul>
  <li>folders/directories:   755 </li>
  <li>files:  644 </li>
</ul>
<p>On Windows hosts, setting files read-only is usually sufficient. Should double-check that the <em>Internet Guest Account</em> has limited (read-only) access. </p>
<h4>Folder Purposes</h4>
<p>The folders for which installation suggests read-write access for  setup are these. If your site supports .htaccess protection, then you should use it for these folders. (The .htaccess files included with v1.3.9 and newer should already cover the basics.) </p>
<ul>
  <li><span class="filename">/cache</span><br>
    This is used to cache database information. The BEST security protection for this is to move it to a  folder "above" the webroot (public_html or htdocs or www) area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in both configure.php files as well as the setting in your admin for Admin &gt; Configuration &gt; Sessions &gt; Session Directory.)</li>
  <li><span class="filename">/images</span><br>
    This is discussed earlier in this article. </li>
  <li><span class="filename">/includes/languages/english/html_includes</span><br>
    This is discussed earlier in this article. </li>
  <li><span class="filename">/logs</span><br>
    This is used to store error logs. The BEST security protection for this is to move it to a  folder "above" the webroot (public_html or htdocs or www) area, so that it's not  accessible via a browser. (Requires changes to DIR_FS_LOGS setting in both configure.php files.)</li>
  <li><span class="filename">/media</span><br>
    This is only suggested read-write for the sake of  being able to upload music-product media files via the admin. Could be  done by FTP as an alternative. </li>
  <li><span class="filename">/pub</span><br>
    This is used on Linux/Unix hosts to have downloadable products made available to customers via a secure delivery method which  doesn't disclose the 'real' location of files/data on your server (so that people can't share a URL and have their friends steal downloads from your site) </li>
  <li><span class="filename">/admin/backups</span><br>
    This is used by the backup module to store database backups. Optional. </li>
  <li><span class="filename">/admin/images/graphs</span><br>
    This is used by the Admin &gt; Tools &gt; Banner Manager for updating/displaying bar graphs related to banner usage. If not writable, this feature is ignored. <br>
</li>
</ul>
<h1>11. Remove the print URL from your browser's headers </h1>
<p>To stop the browser from printing a URL (which discloses your Admin foldername) on the invoice or any other document on the web, follow these steps:</p>
<p> For Internet Explorer:<br>
o Click on File then Page Setup <br>
o At page setup, remove this two character combination: &quot;&amp;u&quot; from the header or footer text box. </p>
<p>For Firefox:<br>
o Click on <em>File</em> then <em>Page Setup<br>
o </em>On page setup window click on the tab "Margins &amp;  Header/Footer". In the "Header &amp; Footer" section set all of the  drop downs to --blank--. (Or at least remove all references to &quot;Title&quot; and &quot;URL&quot;.)</p>

<h1>12. Things to Check Up on Regularly</h1>
<ol><li>Be sure you've done all the steps listed in this document</li>
<li>Keep good backups of your website files and database (frequently)<ul>
<li>Backup the database over a secure connection (ie: if you're using phpMyAdmin to backup, then make sure you're using HTTPS addresses in your URLs).</li>
<li>Backup the website files over a secure connection (If you're copying files via FTP, be sure to use SECURE-FTP <a href="http://en.wikipedia.org/wiki/FTPS" target="_blank">FTP over SSL/TLS</a>). A good tool that supports Secure FTP (SFTP) is WinSCP, provided you configure your connection in it accordingly.)</li>
<li>Store the backed up database and website files into an encrypted file. (You should NOT keep your backups on your server. But if you do, encrypt them securely. See your hosting company for advice.)</li></ul></li>
<li>Check your server's errorlog regularly for odd or suspicious activity  (Your hosting control panel should give you access to the Apache error_log)<ul>
<li>look for any links that went to a page that isn't in your site
<li>look for links that have http after the index.php </li></ul>
<li>Check your website files regularly to be sure nothing's been added or altered
<li>Ask your webhost what they have done to be sure the server you're on is safe and secure so that outsiders cannot do any harm, and so that other websites on your server cannot be used to get to your site and cause any harm (in case they have security holes in them)
<li>If your business warrants, or you still want additional assurance (esp if running forum software on your site, or other scripts outside of Zen Cart&reg;), hire a security consultant to check your site regularly and give you peace of mind in exchange for a few dollars </li>
<li>Check your Zen Cart /cache/ folder for leftover files that don't belong there.</li>
<li>Check your Zen Cart /logs/ folder for myDebug-XXXXX.log files to see whether any errors are happening which need to be fixed. Delete the log files after you've addressed the errors.</li>
</ol><br>
</fieldset>

<p class="center"><em>Copyright 2003 - 2013 Zen Ventures, LLC &mdash; Zen Cart&reg; www.zen-cart.com</em></p>
</body>
</html>
